I am curious as to when the sys_exit system call is actually called in Linux. I am writing a module to track system calls and find that when I open and close vim I do not necessarily immediately register a call to sys_exit. Sometimes the call appears to be delayed instead.
Does anyone know the top-secret semantics behind this? Are we SURE it calls sys_exit immediately upon “:wq!” or “:q!” or is there some more dastardly workings afoot?
sys_exit should be called each time you stop a process normally:
exit_group(0) = ?
Process 14439 detached
What do you see in strace?